Do I need to have a connected app?
Yes. If you are using REST API to integrate with Salesforce, then you will need a Connected App.
If so, what is the callback url? I have taken a few trailheads and understand that the callback URL is used for human interaction but this is all automated and I'm not sure that there is a URL as such.
Callback URL is the URL where you want the access token code to be sent to after successful authentication. It can be any URL or even a localhost URL on a specific port. There is not necessarily a human interaction required here. You just need a URL where you can receive the token after the authentication. So if you are authenticating using an API, you can always specify a callback URL pointing back to your application which can programmatically accept the incoming token.
Notice this from the Digging Deeper into OAuth 2.0 in Salesforce documentation (emphasis mine):
Apps that use OAuth can also directly authenticate and access Salesforce resources without a user’s presence.
This is how it is defined here on the documentation:
Enter a Callback URL. Depending on which OAuth flow you use, this is typically the URL that a user’s browser is redirected to after successful authentication. As this URL is used for some OAuth flows to pass an access token, the URL must use secure HTTP (HTTPS) or a custom URI scheme. Separate multiple callback URLs with line breaks.
The callback URL field has a limit of 2000 characters, cumulatively. If you enter several URLs and they exceed this limit, configure another connected app to manage more callback URLs.
You should go through the documentation to get more details on the setup for Connected Apps. Good places to start are: